This IP address has been reported a total of
26
times from
18 distinct
sources.
139.28.18.122 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
[Wed Sep 16 02:19:15.899371 2026] [php:error] [pid 771150:tid 771150] [client 139.28.18.122:35940] s ...
show more[Wed Sep 16 02:19:15.899371 2026] [php:error] [pid 771150:tid 771150] [client 139.28.18.122:35940] script '/var/www/nextcloud/apps/richdocumentscode/shx1ae6a.php' not found or unable to stat
[Wed Sep 16 02:19:17.908411 2026] [php:error] [pid 771132:tid 771132] [client 139.28.18.122:58480] script '/var/www/nextcloud/apps/richdocumentscode/shx1ae6a.php' not found or unable to stat
[Wed Sep 16 02:19:19.763650 2026] [php:error] [pid 771134:tid 771134] [client 139.28.18.122:58496] script '/var/www/nextcloud/apps/richdocumentscode/shx1ae6a.php' not found or unable to stat
...
show less
Active command injection attacks against a [internal host] server, successfully executing shell comm ...
show moreActive command injection attacks against a [internal host] server, successfully executing shell commands to drop a PHP webshell. Target: HTTPS 443 ([internal host]), GET /x$(x=... base64-encoded bash injection) targeting path traversal/RCE vulnerability.. Seen: 2026-09-15 08:00 to 09:40 US Eastern. Evidence: Graylog logs show continuous GET requests from 139.28.18.122 containing bash command substitution syntax returning HTTP 200 responses; Requests attempt to write a base64-decoded PHP file 'shx77b17.php' and cURL a command-and-control webhook; Attacker process (pid 34976) observed on the target host executing system reconnaissance commands.
show less
[Tue Sep 15 02:17:10.188851 2026] [php:error] [pid 763914:tid 763914] [client 139.28.18.122:39910] s ...
show more[Tue Sep 15 02:17:10.188851 2026] [php:error] [pid 763914:tid 763914] [client 139.28.18.122:39910] script '/var/www/nextcloud/apps/richdocumentscode/shxb0010.php' not found or unable to stat
[Tue Sep 15 02:17:12.531337 2026] [php:error] [pid 763915:tid 763915] [client 139.28.18.122:39922] script '/var/www/nextcloud/apps/richdocumentscode/shxb0010.php' not found or unable to stat
[Tue Sep 15 02:17:13.795622 2026] [php:error] [pid 763911:tid 763911] [client 139.28.18.122:39940] script '/var/www/nextcloud/apps/richdocumentscode/shxb0010.php' not found or unable to stat
...
show less
[Mon Sep 14 02:15:09.283209 2026] [php:error] [pid 756385:tid 756385] [client 139.28.18.122:43758] s ...
show more[Mon Sep 14 02:15:09.283209 2026] [php:error] [pid 756385:tid 756385] [client 139.28.18.122:43758] script '/var/www/nextcloud/apps/richdocumentscode/shx1ae6a.php' not found or unable to stat
[Mon Sep 14 02:15:52.732633 2026] [php:error] [pid 756387:tid 756387] [client 139.28.18.122:36990] script '/var/www/nextcloud/apps/richdocumentscode/shxb0010.php' not found or unable to stat
[Mon Sep 14 02:17:07.814528 2026] [php:error] [pid 756385:tid 756385] [client 139.28.18.122:51212] script '/var/www/nextcloud/apps/richdocumentscode/shx1ae6a.php' not found or unable to stat
...
show less
[Sun Sep 13 10:31:03.089416 2026] [php:error] [pid 2932450] [client 139.28.18.122:45970] script '/va ...
show more[Sun Sep 13 10:31:03.089416 2026] [php:error] [pid 2932450] [client 139.28.18.122:45970] script '/var/www/nextcloud/apps/richdocumentscode/shx25086.php' not found or unable to stat
[Sun Sep 13 10:51:30.462949 2026] [php:error] [pid 2943673] [client 139.28.18.122:55690] script '/var/www/nextcloud/apps/richdocumentscode/shx25086.php' not found or unable to stat
[Sun Sep 13 10:51:30.462949 2026] [php:error] [pid 2943673] [client 139.28.18.122:55690] script '/var/www/nextcloud/apps/richdocumentscode/shx25086.php' not found or unable to stat
...
show less
[Sun Sep 13 07:47:25.142293 2026] [php:error] [pid 2844713] [client 139.28.18.122:58372] script '/va ...
show more[Sun Sep 13 07:47:25.142293 2026] [php:error] [pid 2844713] [client 139.28.18.122:58372] script '/var/www/nextcloud/apps/richdocumentscode/shx25086.php' not found or unable to stat
[Sun Sep 13 08:10:26.265665 2026] [php:error] [pid 2856415] [client 139.28.18.122:42446] script '/var/www/nextcloud/apps/richdocumentscode/shx25086.php' not found or unable to stat
[Sun Sep 13 08:10:26.265665 2026] [php:error] [pid 2856415] [client 139.28.18.122:42446] script '/var/www/nextcloud/apps/richdocumentscode/shx25086.php' not found or unable to stat
[Sun Sep 13 08:30:34.527282 2026] [php:error] [pid 2866532] [client 139.28.18.122:34782] script '/var/www/nextcloud/apps/richdocumentscode/shx25086.php' not found or unable to stat
...
show less
[Sun Sep 13 04:33:32.860693 2026] [php:error] [pid 2754681] [client 139.28.18.122:37124] script '/va ...
show more[Sun Sep 13 04:33:32.860693 2026] [php:error] [pid 2754681] [client 139.28.18.122:37124] script '/var/www/nextcloud/apps/richdocumentscode/shx25086.php' not found or unable to stat
[Sun Sep 13 05:28:54.890496 2026] [php:error] [pid 2780286] [client 139.28.18.122:35622] script '/var/www/nextcloud/apps/richdocumentscode/shx25086.php' not found or unable to stat
[Sun Sep 13 05:49:15.358207 2026] [php:error] [pid 2789522] [client 139.28.18.122:56490] script '/var/www/nextcloud/apps/richdocumentscode/shx25086.php' not found or unable to stat
[Sun Sep 13 06:09:07.584967 2026] [php:error] [pid 2799034] [client 139.28.18.122:56264] script '/var/www/nextcloud/apps/richdocumentscode/shx25086.php' not found or unable to stat
[Sun Sep 13 06:28:44.333739 2026] [php:error] [pid 2807744] [client 139.28.18.122:47304] script '/var/www/nextcloud/apps/richdocumentscode/shx25086.php' not found or unable to stat
...
show less
[Sun Sep 13 02:09:24.565991 2026] [php:error] [pid 742461:tid 742461] [client 139.28.18.122:35098] s ...
show more[Sun Sep 13 02:09:24.565991 2026] [php:error] [pid 742461:tid 742461] [client 139.28.18.122:35098] script '/var/www/nextcloud/apps/richdocumentscode/shxb0010.php' not found or unable to stat
[Sun Sep 13 02:09:45.730248 2026] [php:error] [pid 742630:tid 742630] [client 139.28.18.122:33960] script '/var/www/nextcloud/apps/richdocumentscode/shx1ae6a.php' not found or unable to stat
[Sun Sep 13 02:13:23.847271 2026] [php:error] [pid 742630:tid 742630] [client 139.28.18.122:47772] script '/var/www/nextcloud/apps/richdocumentscode/shxb0010.php' not found or unable to stat
...
show less
[Fri Sep 11 18:06:29.981156 2026] [php:error] [pid 686885:tid 686885] [client 139.28.18.122:42154] s ...
show more[Fri Sep 11 18:06:29.981156 2026] [php:error] [pid 686885:tid 686885] [client 139.28.18.122:42154] script '/var/www/nextcloud/apps/richdocumentscode/shx1ae6a.php' not found or unable to stat
[Fri Sep 11 18:07:00.321076 2026] [php:error] [pid 687189:tid 687189] [client 139.28.18.122:60382] script '/var/www/nextcloud/apps/richdocumentscode/shxb0010.php' not found or unable to stat
[Fri Sep 11 18:11:19.463354 2026] [php:error] [pid 688933:tid 688933] [client 139.28.18.122:41928] script '/var/www/nextcloud/apps/richdocumentscode/shx1ae6a.php' not found or unable to stat
...
show less
Hacking
Bad Web Bot
Web App Attack
Showing 1 to
15
of 26 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩